connectrpc / connect-go

The Go implementation of Connect: Protobuf RPC that works.
https://connectrpc.com
Apache License 2.0
2.76k stars 90 forks source link

Restrict handler metadata headers #748

Closed emcfarlane closed 1 month ago

emcfarlane commented 1 month ago

This PR fixes the setting of protocol headers to avoid multiple value headers when providing metadata to a handler. The metadata headers are further restricted to avoid setting protocol headers like "Content-Type". This restriction allows the user to pass the response of a proxy call to a handler without having to filter the response headers themselves. This enforces the protocol headers are set by the handler and that they are unaffected from any user provided metadata.

Previously, returning the response of a client request to a handler would merge the headers together leading to protocol errors from invalid headers such as "Content-Type" having multiple values.